ISO 45001, clause by clause: what each one asks of you

This page explains what the rules and common practice call for. Every site is different, and what a survey or a filing needs at your facility is something we work out with you after we see it.

This guide covers the clauses that matter most in ISO 45001, the international standard for occupational health and safety management systems.

ISO 45001:2018 is at ISO stage 90.92 ("International Standard to be revised"). The draft of the new edition, ISO/DIS 45001, was registered in April 2026 and went to a 12-week ballot in June 2026. Edition 2 is expected in 2027.

The standard described below is therefore current, and you can be certified to it today, but it is on the clock. If you plan a first certification now, you will almost certainly transition to the new edition inside your first cycle. That is not a reason to wait. It is a reason to build your management system so that your own documents do not depend on clause numbers.

We saw exactly this on the environmental side. ISO 14001:2015 was withdrawn on April 15, 2026, and one of its clause numbers now means something different than it did. Assume the same will happen here.

One amendment is already in force. ISO 45001:2018/Amd 1:2024, "Climate action changes," was published in February 2024, and auditors have been able to audit against it since then. It added two things:

It is a small amendment and a short piece of work. But if your context review does not consider climate at all, any auditor can raise it as a finding today, under the current edition. The same amendment was made to ISO 14001:2015 and is incorporated into ISO 14001:2026.

→ ISO 14001 clause guide · Running both standards as one integrated system

The clauses that carry the weight

The rest of this page refers to each clause by its topic. This table matches each topic to its clause number.

Worker consultation and participation: the clause with no US equivalent

OSHA regulates employers. It does not require you to establish a process for non-managerial workers to participate in identifying hazards, assessing risks, investigating incidents and determining controls. It also does not require you to identify and remove the barriers that keep them from participating.

This clause does, and it is the single most common reason a US project stalls at the Stage 2 certification audit.

You cannot produce these records in the 2 weeks before the audit. The auditor will interview non-managerial workers directly, with no manager in the room, and their answers will not match a binder assembled in a hurry.

→ ISO 45001 worker consultation and participation

Hazards, risks and opportunities

This clause has three parts.

Hazard identification. This must be ongoing and proactive, and it reaches factors that a US job hazard analysis often leaves out:

• How work is organized
• Social factors, workload and work hours
• Harassment and bullying
• Leadership and company culture
• Emergency situations
• Past incidents
• People nearby who are not your employees

Risk assessment. You define your methodology and criteria in advance, and you apply them the same way every time.

Assessment of opportunities. This is where the findings come from. You look for opportunities to improve health and safety performance, such as adapting the work to the workers, eliminating hazards at the design stage and improving the culture. You also look for opportunities to improve the management system itself.

Check this third part in your own risk register first. A register with 200 risk lines and zero opportunity lines answers half of this clause, and an auditor can see the imbalance in the time it takes to scroll.

Legal and other requirements

This is your register of OSHA standards. It covers:

• The general industry or construction standards that apply to you
• The substance-specific standards that your exposures trigger
• State plan requirements, where a state runs its own OSHA program
• "Other requirements" you have adopted, such as a customer's contractor safety standard, a corporate policy or a collective bargaining agreement

Check the substance-specific standards line by line. If you do welding, plating, foundry work or abrasive blasting, OSHA's lead, hexavalent chromium, cadmium and silica standards may all apply to you. Each has its own exposure monitoring schedule, and each has a different trigger for periodic monitoring.

→ How often OSHA requires exposure monitoring, by substance · Air monitoring surveys

The hierarchy of controls, and where it lives

The hierarchy of controls is a requirement of the clause on eliminating hazards, in this order:

1. Eliminate the hazard
2. Substitute (replace it with something less hazardous)
3. Engineering controls, such as ventilation, and reorganization of the work
4. Administrative controls, including training
5. Adequate personal protective equipment (PPE)

The word people overlook is order. Some control plans go straight to PPE and training. If the plan has no documented reason for rejecting the higher-level controls, it does not meet this clause, and this is a routine finding. You do not have to implement the top of the hierarchy, but you do have to show that you considered it.

"Respirators" is an answer that holds up only after ventilation and substitution have been evaluated, and OSHA's respiratory protection standard requires you to assess exposure either way.

→ Do respirators replace air monitoring?

Management of change and procurement

Management of change covers new or changed products, services, processes and legal requirements, as well as new knowledge about hazards and developments in technology. It includes temporary changes, and temporary is the word that gets missed. A 3-week workaround during a line rebuild is exactly the kind of condition that causes injuries, and exactly the kind that rarely gets a change review.

The procurement clause has three parts:

• General procurement controls.
• Contractors. Coordinate with your contractors to identify hazards and control the risks that arise from their work, and apply health and safety criteria when you select contractors.
• Outsourcing. Outsourced functions must be controlled, and the type and degree of control must be defined within the management system.

For most industrial sites, the contractor part is the real work. Your contractor prequalification process, however you run it today, becomes a part of the management system that an auditor can examine.

Emergency preparedness, evaluation of compliance, internal audit and management review

Emergency preparedness. Plan the response and provide training, test and exercise the response regularly, then evaluate and revise it. Communicate the relevant information to workers, contractors, visitors, emergency responders and authorities. The communication to contractors is often missing.

Evaluation of compliance. Determine how often and by what method you will evaluate. Then carry out the evaluation, act on it, keep your knowledge of your compliance status current, and retain evidence. This is not the same as an internal audit. It is a conclusion on whether you comply, measured against your register of legal and other requirements, one requirement at a time.

Internal audit. Audits are conducted at planned intervals, and auditors are selected and audits conducted so that the audit process stays objective and impartial. ISO 45001 has no rule against auditing your own work. What it requires is objectivity. In a one-person environmental, health and safety (EHS) department, objectivity has to be built in deliberately. That means an independent reviewer of the findings, sampling against records and not memory, and writing the arrangement into the audit program.

→ Independent internal audits for ISO 14001 and 45001

Management review. The standard specifies what the review must cover. The list includes incidents, nonconformities and corrective action, monitoring and measurement results, and audit results, along with consultation and participation of workers and compliance status. That worker item ties management review directly back to the worker consultation clause.

What we don't claim

We do not hold an ISO lead auditor credential, and consulting does not require one. Auditor competence is a responsibility of your certification body (also called a registrar) under ISO/IEC 17021-1, the international standard that governs certification bodies.

What we bring is the layer underneath: the air monitoring and noise surveys. The hazard and legal requirements clauses require you to have those in hand before any of this can be audited.

→ ISO 45001 consulting · Noise surveys